This Privacy Statement applies to you if you apply for a job, freelance or any other form of temporary position with us (including secondments).   

Who we are 

In this Privacy Statement, the words ‘we’, ‘us’, ‘our’ or ‘National Academy for Social Prescribing’ refers to the National Academy for Social Prescribing, whose registered address is Southbank Centre, Belvedere Road, London SE1 8XX. 

If you have any queries or questions about this Privacy Statement or how we use your personal data, please get in touch by emailing 

This Privacy Statement 

The National Academy for Social Prescribing is a data controller of the personal data we process about you in relation to your recruitment. This means that we are responsible for deciding how we hold and use personal information about you. This Privacy Statement, which we are required by law to provide, explains what personal data we collect about you, how and why we use it, and explains your rights in relation to your personal data.  

What personal data do we collect? 

Personal data means any information which identifies and relates to you (or from which you can be identified). It does not include data where the identity has been removed (anonymous data).  

In connection with our recruitment process, we will need to collect, store, and the use certain categories of personal information about you. We will only collect the personal data we need and most of the personal data we collect is provided directly by you although in some instances, personal data may also be provided to us by third parties, such as recruitment agencies, former employers, and official bodies (such as regulators). 

The personal data we may collect about you as a candidate includes: 

  • personal contact information (including your name, home address, personal telephone number(s) and personal e-mail address) * 
  • general personal information, including your date of birth, gender, NI number, nationality,  marriage/ partnership status  
  • work history and other relevant experience including information contained in CV, cover letter or job application form * 
  • education information including degrees awarded, transcripts and other information provided in support of the job application * 
  • information relating to professional memberships, qualifications and training (including, but not limited to professional revalidation) * 
  • reference information and information received from background checks, including information provided by third parties  
  • your right to work in the UK (including a photocopy of your passport or other immigration document)* 

 The personal data to be provided by you and identified with * above is mandatory in connection with our recruitment activities. Failure to provide mandatory personal data may affect our ability to accomplish the purposes stated in this Privacy Statement, including considering your suitability for employment. 

The list set out above is not exhaustive, and there may be other personal data which we collect, store and use in the context of the application and recruitment process. In particular, we do collect information for equality, diversion and inclusion purposes, but this is held in statistical, fully anonymised format only and so is not considered personal data (as you cannot be identified from it).  As above, we will update this Privacy Statement to reflect any notable changes in the categories of personal data which we process.  

  • Referencing and vetting 

 As part of our referencing and vetting procedures, we may also contact certain third parties in order to verify your personal information (including personal information that you provide as part of the application and recruitment process). These third parties may include, but are not limited to:  

former employers in order to verify your previous employment history  

  • universities and/or other establishments for higher education that you attended in order to verify your education history 

 Regulatory bodies, as necessary.  

  • Recruitment agencies  

 We will only seek this information in relation to successful candidates that have accepted a conditional offer of employment and/or in respect of individuals who are engaged to provides services to us under a secondment agreement and/or contract for employment services, such as freelancers.  

 How we use your personal data 

 We may use your information for a number of different purposes in order to take steps necessary to assess your candidacy, to comply with legal obligations or otherwise in pursuit of our legitimate interestsWe have set out below the main purposes for which your personal data is processed below: 

 To identify and evaluate job applicants, including assessing skills, qualifications and experience 

  • verifying candidate information and carrying out employment, background and reference checks, where applicable and in order to prevent fraud  
  • to ensure you have any applicable professional qualifications, training, registration and revalidation 
  • communicating with you about the recruitment process and your application  
  • to comply with our legal, regulatory, or other governance requirements   
  • for the purposes of conducting data analytics to review and better understand the operation of our recruitment processes, including monitoring of equality, diversion and inclusion albeit only on a fully anonymised basis 

In addition to using your personal data to consider you for the role you applied for, we will retain and process your personal data to inform you about and to consider you for other roles that may be appropriate for you. If you do not want us to consider you for other roles which we consider may be appropriate for you, please inform your HR contact. 

Again, the above list is not exhaustive and we may undertake additional processing of personal data in line with the purposes set out above. We may also process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. We will update this Privacy Statement from time to time to reflect any notable changes in the purposes for which it uses your personal data.  

Lawful basis 

We will only use your personal information when the law allows us to. This means we must have a ‘lawful basis’ for doing so under Article 6 of the UK GDPR. Our lawful basis will vary depending on the purpose, but the lawful bases we generally rely on are as follows:  

  • Article 6(1)(a) – Consent – where we have obtained your consent to collect or use your personal data for a particular purpose  
  • Article 6(1)(f) – Legitimate interests – where we have a legitimate interest to process your personal data for purposes related to the advancement of social prescribing through promotion, collaboration and innovation, to help us improve, to listen to feedback 
  • Article 6(1)(c) – Legal obligation – in some circumstances we may need to process your personal data to comply with a common law or statutory legal obligation, for example, where our regulators require us to hold certain records of our dealings with you. 

Special Category Personal data 

Some of the data we collect about you might include special category personal data, which is data that is subject to additional safeguards. This may include:  

  • Physical or mental health, including any disabilities – we may process information about your physical or mental health in compliance with our obligations owed to prospective disabled employees.  

If you are successful, any health information processed as part of the recruitment process that is relevant to the compliance of our obligations in connection with your employment will be retained and processed in accordance with the Employee Privacy Statement. 

If you are unsuccessful, any health information obtained as part of recruitment process will be deleted with the rest of your personal data within 12 months.  

Equal Opportunities Monitoring – we may process information relating to ethnic origin, race, nationality, sexual orientation and disability, alongside information relating to gender and age, for the purposes of equal opportunities monitoring and on a fully anonymised basis.  

Where we process special category data, then we must also have an additional lawful basis for processing under Article 9 of the UK GDPR. The additional lawful bases that we most commonly use for processing special category personal data are:  

  • Article 9 (2)(b) – Employment – for the purposes of carrying out the obligations and exercising specific rights in the field of employment law; and 
  • Article 9 (2)(f) – Legal claims – where we need to use such personal information to establish, exercise or defend our legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves. 

How we share your data and who with 

We may share your personal data with others. If that is the case, we will keep your personal information confidential and only share it with those listed below for the purposes explained above. We also ensure that we have contracts in place with our suppliers, and that the contract includes the required data protection provisions.  

For example, we may need to share data with the following:  

  • legal advisors, accountants and other professional advisers 
  • auditors and professional service firms who act on our behalf 
  • HMRC and/or any other applicable government bodies  
  • other organisations when providing references/secondment data 
  • disclosure and Barring Service (DBS) (if required 
  • occupational health providers 

Where required, we may share your data to other organisations for the prevention and detection of crime, including for fraud detection and/or prevention purposes, or where we are legally required to share your data.  

Your duty to inform us of changes 

 It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us 

How long we retain your personal data 

We will only hold your personal data for as long as it’s needed for the purpose we collected it for. The precise period of time will depend upon the particular information, what we are using it for and any legal or statutory requirements. We maintain a Data Retention Policy which includes details of our agreed retention periods for specific types of information, including the amount of time for which we process information relating to your employment. Typically however, the following retention periods will apply: 

For unsuccessful candidates: 

  • We will typically retain personal data collected during the recruitment process for a maximum period of 12 months from the end of the process subject to any exceptional circumstances and/or to comply with particular laws or regulations. 
  • We may retain select data relating to particular candidates on file for a longer period than 12 months in order to follow up with the candidates in relation to future vacancies; as above, if you do not wish for your personal data to be maintained on file for this purpose, please inform us.   
  • We will typically retain personal data held in archived e-mails or other electronic files for 12 months  

For successful candidates: 

We will retain the personal data we collect during the recruitment process for 12 months   

  • Once you are no longer an employee, worker or contractor of National Academy for Social Prescribing we will retain and securely destroy your personal information in accordance with our Data Retention Policy and applicable laws and regulations.  

A copy of the Data Retention Policy can be provided on request, but if you would like more information about our data retention practices, please contact us by emailing 

International Data Transfers 

Sometimes we, or third parties working on our behalf, may need to transfer personal data outside of the UK. If that is the case, we will take the necessary steps to ensure that appropriate safeguards are in place. Some transfers may be to countries that are considered to have adequate levels of protection, such as those in the European Economic Area. For transfers to other countries, we may put contracts in place with the party to whom we are sending information. 

If you would like further details regarding international transfers, please contact us by emailing 

How we protect your personal data  

We take the security of your personal data seriously and use technical, organisational and physical security measures to protect your personal data. Unfortunately, the transmission of information via the internet is not completely secure.  Although we will do our best to protect your personal data, we cannot guarantee the security of data that you transmit to our site; any transmission is therefore at your own risk. 

We also provide appropriate training to our employees to help us comply with our data protection obligations 

Automated decision-making 

You will not be subject to recruitment decisions based solely on automated data processing without your prior consent. 

Your Data Subject Rights 

You have a number of legal rights under data protection laws including:  

  • Access to your personal data – you can ask us to provide a copy of your information together with specified details about how we use your personal data 
  • Rectification – If you believe that your personal data is inaccurate, incomplete or out of date, you may ask us to rectify it 
  • Erasure – in certain circumstances, you may have a right to request erasure of your personal data but this is not an absolute right 
  • Restricting processing – you may ask us to restrict or suppress the processing of your personal data in certain circumstances 
  • Data portability – in some cases, you have a right to move, copy or transfer certain personal data that have been provided by you to another organisation  
  • Objection – you can object at any time if you want us to stop sending you direct marketing. You can also object for some other types of processing in certain circumstances. 
  • Automated decision making and profiling – you have the right not to be subject to decision-making or profiling which is based on automated process, unless certain criteria are fulfilled.  However, as confirmed above we do not undertake any automated processing. 
  • Withdrawal of consent – if our legal basis for processing your personal data is consent, you may withdraw your consent at any time 

Many of these rights are not absolute or may be subject to exemptions in certain circumstances. 

If you wish to exercise any of these rights, you can contact us by emailing  

You may also find further information about your rights using the Information Commissioner’s Officer (ICO) website: 

If you are not happy with how we handle your personal data, please contact us by emailing  You may also choose to make a complaint to the ICO 


This Privacy Statement is updated from time to time, for example if a change is needed due to legal requirements or a change in processing activities. Please check this page from time to time to see the current version. 

We last updated this Privacy Statement on 27th September 2021.